Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 18:06

General

  • Target

    source_prepared.exe

  • Size

    83.6MB

  • MD5

    38644fdaf411524e61fbd3fc6f054cc6

  • SHA1

    eb1ad7cd05a6628c2a46550ee871e6898bc93d5c

  • SHA256

    e2373c15090105d358c3ef7fa4ed03c6cd5a6a55a2db6efb020643e03a87d26a

  • SHA512

    e189f359fb9564dddaa6edc95d87895a0cc958c31780bbc81f9239df775668b393495e38c64a7f384f670c2ab75e20163145b1832dca29426e6d7477a93e3b00

  • SSDEEP

    1572864:OGKlSWOsmwSk8IpG7V+VPhqLadANE7qliSiYgj+h58sMwUerylq1cJFO:fKYVsmwSkB05awLOAxwc5AerCD

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
      "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
      2⤵
      • Loads dropped DLL
      PID:2940

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI23722\api-ms-win-core-file-l2-1-0.dll

          Filesize

          21KB

          MD5

          51cdd94858eadfa992e3a397aae6a4ee

          SHA1

          6fe3a27f11c13fdd680802eb8c6f87a7a92518d6

          SHA256

          57cb180884f33b064957d9c1dd509bb5e8fd541e9458b84d88e025790c1dc986

          SHA512

          42702b377322fcd6e7090a01c262ce3a04a95154ff327a40841add210f678287658ad097e32bd53f23d88878cbe7625d868b7adfac042cdbc0f48e8e59b7504e

        • C:\Users\Admin\AppData\Local\Temp\_MEI23722\python311.dll

          Filesize

          1.6MB

          MD5

          476ab587f630eb4f9c21e88a065828b0

          SHA1

          d563e0d67658861a5c8d462fcfa675a6840b2758

          SHA256

          7cf19201904e4e7db4e5e44cd92d223fb94ddd43da04a03d11e388bf41686b8b

          SHA512

          3d67e49a09777e6fab36c37cf3a7c2768382eb1c850638b0064e2b00479f74251bb70290fe62971944344ee88b7803ee1697a374a62c7f7c45a556c820800676

        • C:\Users\Admin\AppData\Local\Temp\_MEI23722\ucrtbase.dll

          Filesize

          1.1MB

          MD5

          b76f01ae50ce43187be1d701b51ca644

          SHA1

          cb59f1ff16f8f3996646930f02d3090422c64a02

          SHA256

          903806c8888e3c9ac0212ed50be6889c21cf4fd12f49931da8b548b5326a0bf8

          SHA512

          d0962bdc5439c7068d67e59d6434606581744daf41a628c083ae147936074f489b44dca8dd737a6766dcdc2b99a2cb7e5cbc79e13e0d9b661f77acd13a9c5300

        • \Users\Admin\AppData\Local\Temp\_MEI23722\api-ms-win-core-file-l1-2-0.dll

          Filesize

          21KB

          MD5

          d54860bc805f73cd8e7e3fe05d544108

          SHA1

          b6184d9f4477e482801a0fa1f27b868533873d1d

          SHA256

          68e28b5944193ab45be2cc14e49424ba0c5d8713bb6b027e96ff1c16147f19a3

          SHA512

          22dffca161acdad3bcda6bc83ca63d4cedcbfd47b1b3549e98fc95d9b85ce2d49576f3ee3fc150da2e353731bf8d98e4eb3db80ba3913b32e783289905376a3a

        • \Users\Admin\AppData\Local\Temp\_MEI23722\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          21KB

          MD5

          c8cfb99f387edd7ee3677d10faed635e

          SHA1

          f5d0776b3e58ba231dfd5ff5e3a63860652b7ee5

          SHA256

          361ebbef6e0d77624560b87d888464b331403e09845836a04f5800682aa4ed48

          SHA512

          1332ae54f4af98365b973fe82311a09cec2a92e07f0ef56512bf3e2a3eef9d45e9484a74eae20df6a7fe44b6758bd6aedd16bc96ae866f2536a7c906f7535af0

        • \Users\Admin\AppData\Local\Temp\_MEI23722\api-ms-win-core-processthreads-l1-1-1.dll

          Filesize

          21KB

          MD5

          ab08093ceb1da2c238f28dec5e2db51e

          SHA1

          f3c97f9aea448b503390794b56d0cc1e5795e4d5

          SHA256

          92bb2dd3172befd83dc039deb83577efc0f4e42390aa3d428d6f296bd3f462fa

          SHA512

          146ebbdee11ebe472c6f45836a5051cb6c53db04bd8d2745fe2097b73b6fb410c1525883271e192523533789318f7825aa678bcba8b0f1d5f354506b4d4ddd11

        • \Users\Admin\AppData\Local\Temp\_MEI23722\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          21KB

          MD5

          6d5cff14d7b266bc9cfdeefb0a05d2a8

          SHA1

          5d76f1a5e3ac3caf2c7cd19590e8e578f55c1ccc

          SHA256

          bc0a3295b1e552f47f7034d47dcaa9123caa9423d202df5737b9301d68cb6667

          SHA512

          5af85dde1bef032893b4e5fdf4584ddc51dd33cc73be1e37f230544f6df383927995027bd5097ad23d0248e3980b66767698177c8ee8d61d309ab5dbb6ce3662

        • memory/2940-1322-0x000007FEF5500000-0x000007FEF5AF0000-memory.dmp

          Filesize

          5.9MB